VPN-1 UTM, SmartCenter and logging

[osterber]

I have a question about a new install of Checkpoint.

I'm licensing the VPN-1 UTM software. We are a relatively small and straightforward site -- a single internal subnet, a DMZ, and a handful of SecureRemote clients.

My plan is to install the firewall module on dedicated hardware. Then, it sounds like I can get away with installing a SmartCenter server onto our existing VMWare server to manage the policies, etc.

My question is -- where do all of the logs end up? Do I end up with the firewall logs being stored on the firewall hardware? Or do they necessarily get stored on the SmartCenter server? (Since the fw hardware is dedicated hardware, I'll have gobs of disk space. Since the SmartCEnter server is hopefully under VMWare, I'd like to keep disk space to a minimum.)

Thanks.

-Rick

[mcnallym]

The logs normally are sent to the SMARTCenter.

The logs will store locally if they cannot contact the SMARTCenter, and then forward up when connectivity is restored.

I would point out however that Check Point don't officially support SMARTCenter in a virtual environment, even though it does actually work.

[MarioL]

From what you describe, maybe you should install both management and firewall in the same box. I'd probably suggest using SPLAT too.

Any server you can get nowadays (or even an old one) will be able to cope easily. Just be careful with NICs and RAID controllers, to make sure they will be picked up.

[osterber]

I'm thinking you might be right. What was attractive of having a separate SmartCenter was that licensing becomes easier when rolling out a new firewall. (I.e., I have an existing NG firewall on old hardware that I'm completely replacing... but there's a bit of a leap of faith at the final moment to swap the IP addresses, etc.)

I'm definitely on SPLAT. I've got a Dell server that is completely on the hardware list.

-Rick

[chillyjim]

If you can, you really do want SmartCenter on a separate box. It will save you a lot of headaches if you ever expand.

You might also want to look at a UTM-1 450 if you do want to run central.